CDFI CDFI Network Forensics & Traffic Analysis 1 — Questions and Answers
Question 1: Which protocol is most commonly analyzed in network forensics to reconstruct TCP session data?
- UDP
- TCP (Correct answer)
- ICMP
- ARP
Correct answer: TCP
TCP is the primary protocol analyzed in network forensics because its three-way handshake and sequencing allow investigators to reconstruct complete sessions.
Question 2: What tool is widely used by CDFI investigators to capture and analyze live network traffic packets?
- FTK Imager
- Wireshark (Correct answer)
- Autopsy
- EnCase
Correct answer: Wireshark
Wireshark is the industry-standard open-source packet analyzer used to capture and inspect live and recorded network traffic during forensic investigations.
Question 3: In network forensics, what does a 'pcap' file contain?
- Encrypted disk images
- Raw captured network packets (Correct answer)
- Registry hive data
- Browser history records
Correct answer: Raw captured network packets
A pcap (packet capture) file stores raw network packet data recorded from an interface, allowing forensic replay and analysis of network activity.
Question 4: Which NetFlow data element is most useful for identifying the volume of data transferred between two hosts?
- Source port
- Protocol type
- Byte count (Correct answer)
- TTL value
Correct answer: Byte count
The byte count field in NetFlow records indicates the total bytes transferred in a flow, which is key to detecting data exfiltration.
Question 5: What is the primary purpose of analyzing DNS logs during a digital forensic investigation?
- Recovering deleted files
- Identifying C2 communication and domain lookups (Correct answer)
- Decrypting SSL traffic
- Mapping physical network topology
Correct answer: Identifying C2 communication and domain lookups
DNS logs reveal which domains hosts queried, helping investigators identify command-and-control servers, phishing domains, and data exfiltration channels.
Question 6: During a network forensic investigation, a 'SYN flood' pattern in captured traffic most likely indicates which type of activity?
- Normal web browsing
- A denial-of-service attack (Correct answer)
- A successful file transfer
- ARP cache poisoning
Correct answer: A denial-of-service attack
A SYN flood—many TCP SYN packets without corresponding ACKs—is a classic signature of a denial-of-service attack designed to exhaust server resources.
CDFI CDFI Network Forensics & Traffic Analysis 1
Which protocol is most commonly analyzed in network forensics to reconstruct TCP session data?